Question

I am using a dynamically generated query string to display results from a search form for some reports – there are 5 search fields and $query2 could contain nothing or 5 additional search values.

$query="SELECT * from employee_work where company_id='$company_id' $query2";

When I POST the form I get the data displayed on screen which is great. I also then am using TCPDF to offer a PDF download of the data. I currently also the class for TCPDF via POST:

if($_POST['PDF']) {
    do the TCPDF stuff......
}

<div id="export-buttons">
<form name="export" method="post" action="">
<input type="submit" name="PDF" value="PDF" class="button pdf">
</div>

The problem is that when a user clicks on the PDF button the POST array now only contains the value for the submit button and NOT the $query2 data from earlier so when I use TCPDF it outputs all the data and ignores the $query2 part of the search string.

How can I address this so either the original $query2 data stays available OR have anther way of checking if the form button has been clicked without overwriting the contents of POST? Can I use javascript to do this?

Thanks
Jason

Answer 1

why dont you add hidden inputs that have the values of the criteria from the search? That way when the user posts the request for the PDF you get also those fiels and can use them (AFTER making sure the values are SAFE) in the query.

Other safer way is to store in the session an object or array with the parameters that made the list and then pass the identifier of that search as a hidden input to the PDF form, like:

$_SESSION['sc0000001'] = array('field1'=>'value1', 'field2'=>'value2', 'field3'=123);
...
<form>
<input type="hidden" name="sc" value="0000001" />
...
</form>

when you post the form you get the identifier of the search and create the query with the criteria assign to session…

EDITED:
html before posting list criteria:

<form>
<input type="text" name="filter1" value="" />
<input type="text" name="filter2" value="" />
<input type="text" name="filter3" value="" />
<input type="text" name="filter4" value="" />
<input type="text" name="filter5" value="" />
...
<input type="submit" value="go go go" />
</form>

PHP that gets the filters, builds query, gets results and stores in session.

$sql = " select * from table_name where 1 ";

$arrFilters = array();
for($i=1;isset($_POST['filter'.$i]) && trim($_POST['filter'.$i])!="";$i++) { 
$arrFilters['filter'.$i] = mysql_real_escape_string($_POST['filter'.$i]);
$sql.=" AND filter".$i."=".$arrFilters['filter'.$i];
}
// here you should have the complete $sql with the filters supplied

// lets save this search, we are going to keep only the last search from this user in his session.
$_SESSION['listingFilters'] = $arrFilters;

HTML with search results and after the form to get pdf:

<form>

<input type="submit" value="get pdf" />
</form>

PHP:
After the post to get the pdf we go check if there are filters

$sql = " select * from table_name where 1 "; // basic query
// get the filters array from session
$arrFilters = isset($_SESSION['listingFilters']) ? $_SESSION['listingFilters'] : array();
foreach($arrFilters as $filter => $value) { // for each filter add it to the query
$sql.=" AND filter".$i."=".$arrFilters['filter'.$i];
}
// here you should have the complete $sql with the filters in session
// and can do your pdf magic

Add pepper and salt to your pleasure (you need to revise the code to work for you and maybe also the query if you are using text has filters)